Sygnia uncovers Fire Ant's cyber-espionage expanding to Cisco IOS XR routers, TACACS servers, and Linux hosts using invisible tunnels and credential theft.
On 13 August 2026, Hunt.io researchers identified an unprotected server in Amsterdam 31.58.209 . 241 exposing a Python SimpleHTTP directory on port 8000.
Between late September 2025 and early April 2026, government and diplomatic organizations in Romania, Spain, and Turkey were targeted by a cyber espionage
On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities KEV catalog. The most severe is CVE-2023-49105, an
GoCaracal malware by Dark Caracal discovered, with dual variants and Ethereum-based C2 backup for advanced espionage operations.
FBI disrupts Chinese hacking platforms QScan and QTRouter used to attack US critical infrastructure, including NASA and Federal Reserve.
DOJ seizes Chinese QScan and QTRouter platforms used to hack US agencies and infrastructure, part of ongoing cyber operations.
On August 26, 2026, Group-IB published a new technical analysis on Nimbus Manticore, an Iranian state-sponsored group affiliated with the IRGC. The actor
CISA red team assessments show varying detection capabilities in critical infrastructures, with both ultimately breached.